June 24, 2015
How will new chip-and-PIN technology for credit/debit cards affect who is liable for a fraudulent transaction?
Dear Consumer Ed:
I heard that the magnetic strip on debit and credit cards is going to be replaced with chip-and-PIN technology. How will that affect who is liable (consumer or merchant) in the case that a fraudulent transaction occurs?
Consumer Ed says:
The financial responsibility for fraudulent credit card transactions currently lies with either the merchant or the issuer (the bank or the credit card company), depending upon the card’s terms and conditions. However, this will change after October 15, 2015, which is the deadline for card issuers and merchants alike (with the exception of gasoline retailers, which have until October, 2017) to switch from magnetic strips to chip-and-PIN technology, also referred to as EMV (Europay, MasterCard and Visa).
EMV is a joint effort conceived by Europay, MasterCard and Visa to ensure better security of card payments for those companies’ users. Adoption of EMV cards and EMV-compliant terminals will purportedly result in a reduction of fraud stemming from counterfeit, lost and stolen cards. EMV cards, which have an embedded microprocessor chip that stores data and information, will rely on the embedded chips and compatible terminals to complete transactions, rather than swipe-and-sign methods currently used.
Further, unlike magnetic-stripe cards, every time an EMV card is used, the card’s chip will create a unique transaction code that cannot be used again. After the October 15, 2015 deadline, liability for fraudulent credit or debit card transactions that still use magnetic stripes will be shifted to the party that has not switched to EMV technology; note that this shift in liability won’t fall on the consumer, but is between the card-issuer and the merchant.
The change in technology is unlikely to have much of an effect on consumers’ liability for fraudulent debit and credit card transactions. This is because under the Federal Fair Credit Billing Act, your liability for unauthorized credit card charges is capped at $50. However, once the suspected sham transaction is reported, consumers aren’t held responsible for any further amounts fraudulently charged to their cards. It’s a bit different for debit cards: if an ATM or debit card is reported missing before someone uses it, the holder isn’t responsible for any unauthorized transactions; but, if someone uses the ATM or debit card before it’s reported lost or stolen, the amount the holder is liable for depends on how quickly the loss is reported.
Debit card losses fall along the following scale: Consumers aren’t responsible for any amounts if the missing card is reported before any unauthorized charges are made; for missing cards reported within two business days after the holder learns of the loss or theft, the amount is capped at $50; for unauthorized charges reported 2 business days after the holder learns of the loss/theft, but less than 60 calendar days after the bank sends its statement to the cardholder, amounts are capped at $500; and for unauthorized charges reported after 60 calendar days, the cardholder is responsible for all charges.
To limit any liability you may have for purchases you didn’t make, or for transactions that may get charged to a card that has been lost or stolen, make sure you report the suspect purchases (or the loss or theft of the card) as soon as possible to the card’s issuer. Follow up with a letter to your issuer to further document the report, and make sure you update your records to keep track of the issuer’s actions taken to nullify the transaction. You can learn more about how to protect yourself by visiting the Georgia Attorney General's Consumer Protection Division website at https://consumer.georgia.gov/consumer-topics/identity-theft-what-do-if-it-happens-you.